diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 272716d..5cbc681 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,6 +1,12 @@
 variables:
   DOCKER_REPOSITORY: registry.mender.io/cfengine/cfbuild
   DOCKERFILE: Dockerfile
+  MULTIPLATFORM_BUILD: "true"
+  MULTIPLATFORM_PLATFORMS: "linux/amd64" # Hugo binary in the Dockerfile is amd64-only
+  # build.js authenticates to the GitHub API with this token to avoid rate limits.
+  # The multiplatform buildx job reads EXTRA_DOCKER_ARGS (not the legacy inline
+  # --build-arg), so pass the token through there.
+  EXTRA_DOCKER_ARGS: "--build-arg GITHUB_USERNAME_TOKEN"
   DOCKER_HOST:
     value: 'tcp://docker:2376'
     description: "Required to run dind inside k8s runners with TLS"
@@ -25,20 +31,21 @@ stages:
   - publish
   - sync
 
+# QA-1487 deprecated build:docker/publish:image (their scripts now exit 1). Opt
+# into the buildx multiplatform variants and disable the legacy and mender jobs.
 build:docker:
+  rules:
+    - when: never
+
+build:docker-multiplatform:
   rules:
     - if: '$CI_COMMIT_BRANCH =~ /^(master|production)$/'
-  script:
-    - echo "building ${CI_PROJECT_NAME} for ${DOCKER_BUILD_SERVICE_IMAGE}"
-    - docker build
-        --tag $DOCKER_BUILD_SERVICE_IMAGE
-        --file ${DOCKER_DIR:-.}/${DOCKERFILE:-Dockerfile}
-        --build-arg GIT_COMMIT_TAG="${DOCKER_PUBLISH_COMMIT_TAG}"
-        --build-arg GITHUB_USERNAME_TOKEN
-        ${DOCKER_DIR:-.}
-    - docker save $DOCKER_BUILD_SERVICE_IMAGE > image.tar
 
 publish:image:
+  rules:
+    - when: never
+
+publish:image-multiplatform:
   rules:
     - if: '$CI_COMMIT_BRANCH =~ /^(master|production)$/'
 
@@ -46,6 +53,10 @@ publish:image:mender:
   rules:
     - when: never
 
+publish:image-multiplatform:mender:
+  rules:
+    - when: never
+
 sync:image:
   rules:
     - if: '$CI_COMMIT_BRANCH == "production"'
diff --git a/Dockerfile b/Dockerfile
index 2c2db9c..16c9447 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,8 +1,8 @@
 FROM node:26-alpine AS build
 ARG GITHUB_USERNAME_TOKEN
 WORKDIR /build-website
-ADD https://github.com/gohugoio/hugo/releases/download/v0.163.3/hugo_0.163.3_Linux-64bit.tar.gz hugo.tar.gz
-RUN echo "ec422258f9a4ffc241de8707297e32311cd86fcc9b2813632617ff4d44935d91  hugo.tar.gz" | sha256sum -c
+ADD https://github.com/gohugoio/hugo/releases/download/v0.164.0/hugo_0.164.0_Linux-64bit.tar.gz hugo.tar.gz
+RUN echo "d9c8b17285ea4ec004d9f814273ea910f2051ce02c284993fd1f91ba455ae50d  hugo.tar.gz" | sha256sum -c
 RUN tar -zxvf hugo.tar.gz
 COPY package-lock.json package.json ./
 RUN npm ci